# WebDecoy

WebDecoy は、Vercel のサイトやアプリに届く自動化トラフィックを監視し、クローラー、AI ボット、ツール、user agent のないリクエストを識別します。公開済み IP 範囲または署名付きリクエストを検証し、偽装されたよく知られた user agent にフラグを立て、対応する Vercel プランではアプリケーションコードを変更せずに活動状況を報告します。

- Findings24: <https://findings24.com/ja/products/webdecoy>
- ウェブサイト: <https://webdecoy.dev>
- 料金: Freemium
- カテゴリー: Developer Tools

## WebDecoyとは？

WebDecoy is a monitoring tool for identifying automated traffic that reaches a Vercel site or application. It observes requests that conventional analytics may miss, including crawlers that do not execute JavaScript, and distinguishes reported crawler identities from requests that may be spoofing a known user agent.

For Vercel projects, connecting WebDecoy creates a log drain so the service can analyze request-level data without a code change or redeploy. On Vercel Hobby teams, the alternative is a line of `@webdecoy/next` middleware. WebDecoy is monitoring-only: it does not block or challenge requests.

## WebDecoyでできること

### Request-level crawler visibility

Reports crawlers, tools, and requests with no user agent based on traffic received by the site, including automated visitors that browser-based analytics may not capture.

### Identity verification

Verifies crawlers that publish IP ranges or sign their requests, helping distinguish claimed identities from observed request characteristics.

### Spoofing flags

Flags requests that appear to forge a well-known user agent rather than treating every matching user-agent string as verified.

### Vercel log-drain setup

Connecting a project creates a Vercel log drain and sends request data such as user agent, path, status, client IP, and TLS fingerprint to WebDecoy.

### No-redeploy monitoring setup

The Vercel connection does not require an application code change or redeploy. It also creates three environment variables used by the optional Next.js middleware.

### Project cleanup

Disconnecting a project removes its WebDecoy log drain and the three variables created by the integration; disconnecting the integration removes everything it set up.

## 利用シーン

### Audit AI and crawler traffic

Site owners can see which automated agents are reaching their Vercel site, including agents invisible to JavaScript analytics.

### Investigate questionable bot identities

Teams can review verification results and spoofing flags when a request claims to be a recognized crawler or bot.

### Monitor traffic without application changes

Vercel Pro or Enterprise teams can connect a project and use the log-drain workflow without modifying application code or redeploying.

### Monitor a Hobby project with middleware

Hobby users can use the documented \`@webdecoy/next\` middleware path when a Vercel log drain is unavailable to their team plan.

## よくある質問

### What traffic does WebDecoy report?

It reports crawlers, tools, and requests with no user agent. Human visitors are not reported.

### How does WebDecoy verify a crawler?

It verifies crawlers that publish their IP ranges or sign their requests, and flags requests that appear to forge a well-known user agent.

### Does connecting a Vercel project require code changes?

For projects using the Vercel log-drain connection, WebDecoy sets up the drain without a code change or redeploy. On Hobby, the documented alternative is to add one line of \`@webdecoy/next\` middleware.

### Which Vercel plans support the log-drain setup?

The listing states that drains require a Pro or Enterprise team. Vercel’s pricing page lists Hobby as a free plan, Pro at $20 per month, and Enterprise as a custom plan; these are Vercel plan prices, not stated WebDecoy prices.

### Does WebDecoy block or challenge bots?

No. It is for monitoring only and never blocks or challenges a request.

## クイック情報

- **Category**: Security monitoring
- **Platform**: Vercel
- **Traffic scope**: Crawlers, tools, and requests with no user agent
- **Vercel workflow**: Log drain for Pro and Enterprise teams
- **Hobby workflow**: \`@webdecoy/next\` middleware
- **Reported request data**: User agent, path, status, client IP, and TLS fingerprint